James He

Head of Cybersecurity for L’Oréal Greater China

• Act as Project Leader to run an industry leading CSL program for regulatory compliance & security fundamentals • Execute critical initiatives such as System and Data Localization in line with regulatory and commercial interest to deliver value and reduce risk • Provide security and compliance assurance to key initiatives through the suite of security services and offerings, such as MLPS • Identify, measure, and control risks associated with regulatory development and reinforcement trend in Cybersecurity and Personal Information Protection, support GC business through global PIA program. • Provide ongoing security oversight and leadership for Greater China Digital Strategy and Greater China Cloud Platform Compliance program. • Provide CSL guideline to IHG Digital Hotel initiatives. • Oversight GC hotel security operation and compliance enforcement, and incident handling, such as vulnerability management, EOL planning, establish GC Firewall SOC and NOC service, etc.

• Compliance review and gap analysis on China Cybersecurity Laws and Data protection regulations, especially in CPCS formerly known as MLPS, and Cross-border data transfer, etc. • Champion the importance of product security during Philips Secure Development Lifecycle (SDLC) – Security by Design. • Conduct Product Security Risk Assessments (PSRA) and Service Security Risk Assessments (SSRA) in conjunction with the development process of our solutions. • Review security architecture design for healthcare and personal health products deployed on various cloud-based platform and IoT connected device cloud platform with various cloud service suppliers in China, where devices, apps and backend services are securely and seamlessly connected. • Monitor and analyze overall China cyber security law, regulation and standard development, especially on Healthcare personal data protection and Cloud service security, and conduct impact analysis for Philips China Healthcare business operations, and provide strategic advice to business integration solutions. • Lead cyber security submission for medical device products based on CFDA and US DOD RMF requirement. • Deploy product security technology-enabled defenses tools and monitoring tools, such as Static Code Review and SW Bill of Materials Vulnerability (SBOM), and some state-of-art security solutions such as cloud-based Key Management System (KMS), and PKI for code signing, code obfuscation, formalize Security Hardening guideline for Embedded OS, in order to provide products with security designed-in. • Perform Product Security Audit and Compliance activities during the last-mile integration of service and solution we deploy and localize in China Market, such as Social Networks Sharing like WeChat/MiniApp, Push notification Service, User behavior analysis Service Suppliers, etc. • Work with Product Managers, Field Marketing, Services and Sales to collaborate on Product Security topics, incident response and customer complaints.

· Manage physical security and logical security for all North Asia ST plant and Perso centers, including all Visa/MasterCard/ISO27001/Amex/CUP audit compliance. · Manage physical security and logical security for all Asia Telco plant and Perso centers, including all SAS/EAL4+ audit compliance. · Setup Crisis Management and Business Continuity Management framework by conducting Business Impact Analysis and Crisis Risk Assessment, and defining suitable and cost effective strategies to address the identified risks and resilience issues. · Setup all new perso centers in terms of all security process and physical facility, review new business models from security perspective. · Internal audit according to gemalto corporate security standards. · Perform technical review on both infrastructure and application systems, and conduct annual penetration test on Perso Center environment.

Manage and execute multiple Information Security Programs in line with Citigroup Information Security standard, strategy and regulatory requirements. Provide professional consultant and support to business for information security and IT risk control management. Provide positive feedback on various aspects of regulatory compliance China CBRC, PBOC, SAFE, etc. Manage Third Party Information Security Assessment and support Security Matrix Review and Application Compliance Check for new branch, new product and new system from information security control perspective. Identify and assess the risk inherent in particular situation and its impact on business, and consider appropriate controls as part of day-to-day responsibilities to mitigate the risks and enhance the control, keep compliant.

Internal IT support and management in Asia Pacific wide, mainly responsible for 6 offices in China with about 150 end users, Windows/UNIX/LINUX Server and security ACS system maintenance and backup, including some Linux application support for engineering, Office IT equipment sourcing, buying and management, and Keep track of some warranty contract and manage SLA with local vendors, also act as local assistant for Xilinx global IT project. Netapp filer and Symantec Netbackup (VERITAS NBU on Solaris with Quantum Tape Library ) system admin in China. Cisco networking router/switch/AP and LAN/WAN support in Asia Pacific. And I am also the Symantec Antivirus and McAfee ePO Server admin for the whole Asia Pacific with more than 1000 clients, response to security threat, control the desktop environment, configure security policy for respectively group and generate anti-virus health report every month. I am the RSA Token admin for all China users’ VPN remote access.

SST Company Internal IT management, manage Windows Domain, Exchange, Antivirus, File and Printer servers. Telecom backbone routers, ATM Switches and Gigabyte Switch Router management, design and manage the configuration of internal OSPF routing and eBGP routing with multiple external Telecom peers. Provide critical network support to EIS (Enterprise Internet Service) customers in both customer end and telecom Internet infrastructure. Liaise with all the vendors and partners to take charge of the AGN node in Telecom IDC according to the specifications and engineering rules of AT&T AGN. Provide quality day-to-day network support resolving support trouble tickets within the established service level agreement (SLA) targets for AT&T’s global MPLS WAN customers.

Commissioning and provide maintenance of ATM and other Financial System Equipments in China banks. Provide support of computer server on both of Windows NT and NCR UNIX platform to China banks or other critical global customers like Intel, Stock Exchange, etc. Cisco products support, act as a Field Engineer for Cisco and AT&T or other foreign Telecom Company assisting in completing setup all kinds of network equipments and upgrade or cutover project, trace and manage the progress of every case and keep every domestic and overseas Project Manager updated of the status.

Academic Commissioner